Monday 26th March 2018

How do I make my website GDPR compliant?

With lots of talk about GDPR in the business press at the moment, you may be wondering if your website or other web based services are GDPR compliant.

Here at Invent Partners, our software is designed to help you make your website GDPR compliant. Here are some of the ways we can help

GDPR Secure User Data

In order to comply with the requirements of GDPR, you need to have made reasonable efforts to secure your user data. This means making sure that user data is transmitted and stored securely.

SSL: Secure transmission of user data

By using an SSL certificate, you can make sure that your website runs as HTTPS, meaning that your users' data is encrypted before transmission, securing it against interception during transmission. Invent Partners can provide and install SSL certificates and configure HTTPS for your business.

Secure storage of user data

You should make efforts to ensure that your user data is securely stored. For example, many shared hosting services require you to upload and download your data using FTP. This is inherently insecure, and can potentially expose your user data to theft by network interception or by theft of login credentials. To better secure your data, you may wish to consider one or more of the below options:

Restrict server access by IP
In this approach, you would limit FTP / SFTP / SSH access to your webserver to a selected set of defined IP address. Attempts to acces the server from other than these IP addresses would be denied.
SFTP/SSH access only
FTP is inherently insecure, so your data can be intercepted and stolen during transmission. To avoid this, disable FTP, and only permit access via SFTP/SSH.
Use SSH identity certificates
Switch from using password to access your server to using SSH identity certificates. These are much longer than regular passwords, and much more difficult to steal / brute force.
Granular admin panel privileges
If your website has an admin panel, it should allow you to restrict access to user data to only those admin users who really need it.
Appoint a data protection officer
Make one or two people in your organisation responsible for the security of data on your servers. Only grant access to user data these individuals.
Consider a dedicated server
A dedicated server or a dedicated cloud server instance will ensure that no other users apart from your staff have access to the server upon which your data resides. This can help you to ensure that your data is not at risk from being stolen through privilege escalation by another user of the server who is outside of your organisation.

Invent Partners can help you create the correct secure environment for your user data.

Keep an Audit Trail

GDPR requires that you can demonstrate where your user data came from, and what contact / sharing rights and obligations you have on that user data.

Here at Invent Partners, we created a GDPR Compliant CMS with features designed to ensure that a detailed log of user activity is recorded. Our website management platform (CMS) records the following events, with a date time:

User account created
User account in "pending" state
User account activated
Password updated
User account details updated
User account suspended
User account closed
User account deleted
User login
Terms and Conditions accepted
Mailing list subscribe
Mailing list unsubscribe

GDPR Right of Deletion

Under GDPR, individuals have the right to have all the data you hold on them deleted. In order to facilitate this, our website management platform (CMS) offers a GDPR compliant user delete function which will remove all personal data provided by the user.

Speak to Invent Partners

If you would like help getting your website ready for GDPR, contact us today.